Start from known domains, then check attribution
Use approved domain names, network ranges, cloud records and service inventories as the starting points. Certificate records and DNS history can identify possible assets, but a shared host or historical relationship is not proof that an address belongs to you today.
Validate ownership before scanning beyond the agreed scope or asking a supplier to change a service. Record uncertain attribution separately. External discovery is not permission to probe every related organisation or shared hosting neighbour.
Find the service nobody remembers owning
Typical review targets include remote access gateways, exposed management interfaces, abandoned websites, development endpoints and supplier-operated customer portals. Confirm what each service does and whether it still needs to be public before deciding how to treat it.
Cloud exposure is not limited to public virtual machines. Storage access, application endpoints and identity configuration may need a separate configuration review. A network scan alone does not establish the security of an entire cloud environment.
Choose removal, restriction or remediation
For an unused service, decommissioning may be a better treatment than keeping it patched indefinitely. For a necessary service, consider vendor updates, restricted administration, access controls and monitoring. Check the effect on clients and suppliers before removing reachability.
An intermediary protection service can reduce exposure without replacing maintenance of the underlying application. Confirm whether the origin remains directly reachable and whether the protection covers the relevant path. Avoid treating a firewall badge as proof that a vulnerability has been fixed.
Keep ownership and changes in the operating process
Every confirmed asset needs an owner, business purpose, assessment date and treatment status. Schedule review around changes as well as routine discovery. New suppliers, migrations and temporary projects create exposure that a once-a-year review may miss.
Feed actionable exposure into vulnerability management and the risk register where the business consequence is material. Report discovery confidence and unowned services separately from verified vulnerabilities. The aim is a maintained external estate, not a larger list of possible assets.